Threat briefs

YiShaAdmin versions 2.2 through 3.1 contain an unauthenticated path traversal vulnerability in the DownloadFile endpoint, allowing attackers to read or delete arbitrary files via manipulated parameters.

A critical vulnerability in the Java Secure Socket Extension (JSSE) component allows unauthenticated remote attackers to access, modify, create, or delete sensitive data within affected Oracle Java SE and GraalVM environments.

An integer-overflow vulnerability in RedisBloom CMSketch RDB deserialization allows an authenticated attacker to trigger out-of-bounds memory access, resulting in potential remote code execution or denial of service.

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in the ShowMsg() function, allowing unauthenticated attackers to execute arbitrary system commands via a crafted HTTP Referer header.

The CozyThemes Rootblox plugin for WordPress, versions 1.0.6 and earlier, contains a Local File Inclusion vulnerability that allows unauthenticated remote attackers to include arbitrary files, potentially leading to remote code execution.

A critical vulnerability in the RingRTC library used by Signal allows a remote peer to block call termination by flooding the Finite State Machine (FSM) event queue, enabling unauthorized extension of audio and video capture.

Keycloak versions up to 26.8.1 are vulnerable to privilege escalation where a user with "manage-users" permissions can assign composite roles containing "realm-admin" privileges due to incomplete authorization checks.

Obot versions prior to 0.26.0 contain an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to harvest API keys by manipulating token requests.

CVE-2026-48849 is a stored XSS, HTML, and CSS injection vulnerability in Roundcube Webmail that enables malicious payload execution upon session restoration.

A vulnerability in quic-go, an implementation of the QUIC protocol in Go, allows a remote attacker to cause a denial-of-service (DoS) condition by sending specially crafted QPACK-encoded HEADERS frames with large trailer field sections, leading to excessive memory allocation in affected HTTP/3 client and server implementations prior to version 0.59.1.

An unauthenticated file upload vulnerability, CVE-2026-55450, in Langflow versions prior to 1.9.1 allows remote attackers to upload arbitrary amounts of data to the server via the `/api/v1/upload/{flow_id}` endpoint, leading to disk space exhaustion and Denial-of-Service, additionally leaking the absolute file path in the server's response.

Exploitation of CVE-2024-29824, a critical SQL injection vulnerability in Ivanti Endpoint Manager (EPM), allows remote code execution via a crafted HTTP POST request to the `/WSStatusEvents/EventHandler.asmx` endpoint.

CVE-2025-49132 is a critical unauthenticated remote code execution vulnerability in Pterodactyl Panel caused by local file inclusion in pearcmd.php, for which public proof-of-concept exploits are now available.

A local privilege escalation vulnerability in the Amazon WorkSpaces Skylight Workspace Config Service allows low-privileged users to achieve arbitrary file writes as SYSTEM via a TOCTOU race condition during log rotation.

An unauthenticated remote code execution vulnerability (CVE-2026-53921) in the OpenWrt DHCPv6 server component odhcpd allows attackers to execute code with root privileges via crafted DHCPv6 requests.

Casbin Casdoor versions prior to 3.54.1 are vulnerable to an authenticated path traversal vulnerability that allows attackers with administrative access to write arbitrary files to the server, leading to RCE or DoS.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize() due to improper handling of session keys prefixed with "!".

NT OneAPP fails to validate server certificates and hostnames, allowing network-adjacent attackers to conduct man-in-the-middle attacks.

A public exploit exists for a use-after-free vulnerability in the legacy JScript engine (jscript.dll) that allows remote code execution via Internet Explorer 11.

An integer overflow vulnerability in GitLab CE/EE allows unauthenticated attackers to execute arbitrary code via specially crafted regular expressions.

Frappe Framework versions prior to 16.33.0 contain a blind SQL injection vulnerability in the get_events method, allowing authenticated attackers to extract sensitive database content.

Vyper versions 0.4.0b1 through 0.5.0b1 miscompile unfoldable constants and omitted default arguments from imported modules, potentially allowing attacker-influenced input to corrupt validation or accounting logic.

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role.

The Grav Login plugin contains a missing authorization flaw in the login.invite task, allowing unauthenticated attackers to register arbitrary email addresses as super users by manipulating page frontmatter.

Traefik versions prior to 3.7.14 contain an access-control bypass vulnerability in the Kubernetes Ingress NGINX provider that allows unauthenticated access to backends protected by security annotations.

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary operating-system command execution.

Researchers identified that Java’s certificate blocklist (blocked.certs) can be bypassed for compromised certificates by re-encoding them to produce different SHA-256 fingerprints while maintaining signature validity.

A security flaw in TOTOLINK EX200 firmware 5.2.3c.7200 allows for remote stack-based buffer overflow via the Comment argument in the setStaticDhcpConfig function.

Rex versions through 1.16.1 for Perl accept unknown SSH host keys during remote rsync transfers due to a hardcoded StrictHostKeyChecking=no configuration.

The Net::LibSSH Perl module fails to verify host keys against known_hosts during connection establishment, enabling man-in-the-middle attacks.